420 Rec'd PCT/PTO 0 2 FEB 2000 

IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re International Application of Shiho MORIAI et al. 
International Serial No. PCT/ JP99/02924 
International Filing Date: June 1, 1999 

For: "APPARATUS AND METHOD FOR EVALUATING RANDOMNESS OF 

FUNCTIONS^ RANDOM FUNCTION GENERATING APPARATUS AND 
METHOD^ AND RECORDING MEDIUM HAVING RECORDED THEREON 
PROGRAMS FOR IMPLEMENTING THE METHODS" 

VERIFICATION OF TRANSLATION 

Honorable Commissioner of Patents and Trademarks 
Washington, B.C. 20231 

Sir: 

Takeshi Ito residing at 12-7, Nakameguro 4-chome, Meguro-ku, 
Tokyo, Japan, declares: 

( 1 ) that he knows well both the Japanese and English 
languages ; 

(2) that he translated the above-identified International 
^ Application from Japanese to English; 

(3) that the attached English translation is a true and 
. correct translation of the above-identified International 

Application to the best of his knowledge and belief; and 
* (4) that all statements made of his own knowledge are true 
and that all statements made on information and belief are 
believed to be true, and further that these statements are made 
with the knowledge that willful false statements and the like 
are punishable by fine or imprisonment, or both, under 18 USC 
1001, and that such false statements may jeopardize the validity 
of the application or any patent issuing thereon. 




Dated 



Takeshi Ito 



TITLE OF INVENTION: "APPARATUS AND METHOD FOR EVALUATING RANDOMNESS OF 

FUNCTIONS, RANDOM FUNCTION GENERATING APPARATUS AND 
METHOD, AND RECORDING MEDIUM HAVING RECORDED THEREON 
PROGRAMS FOR IMPLEMENTING THE METHODS" 



^ /463907 

-i- 420 Rec'd PCT/PTO 0 2 FEB 2000 

APPARATUS AND METHOD FOR EVALUATING RANDOMNESS OF 
FUNCTIONS, RANDOM FUNCTION GENERATING APPARATUS AND 
METHOD, AND RECORDING MEDIUM HAVING RECORDED 
THEREON PROGRAMS FOR IMPLEMENTING THE METHODS 

5 

TECHNICAL FIELD 

The present invention relates to an apparatus and method which are 
applied, for example, to a cryptographic device to evaluate whether 
candidate functions satisfy several randomness criteria so as to obtain a 
10 function that generates an irregular output from the input and hence make 
the analysis of its operation difficult; the invention also pertains to an 
apparatus and method for generating a random function evaluated to satisfy 
the randomness criteria, and a recording medium having recorded thereon 
programs for implementing these methods. 

15 

PRIOR ART 

Encryption techniques are effective in concealing data. Encryption 
schemes fall into a secret-key cryptosystem and a public-key cryptosystem. 
In general, the public-key cryptosystem is more advanced in the research of 
20 security proving techniques than secret-key cryptosystem, and hence it can 
be used with the limit of security in mind. On the other hand, since no 
security proving techniques have been established for the secret-key 
cryptosystem, it is necessary to individually deal with cipher attacks when 
they are found. 

25 To construct fast and secure secret-key cryptography, there has been 

proposed a block cipher scheme that divides data into blocks of a suitable 
length and enciphers each block. Usually, the block cipher is made secure 
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by applying a cryptographically not so strong function to the plaintext a 
plurality of times. The cryptographically not so strong function is called an 
F-function. 

It is customary in the art to use, as an element of the F-function, a 
5 random function, called an S-box, which generates an irregular output from 
the input thereto, making it difficult to analyze its operation. With the S- 
box that has the random function capability of providing a unique 
input/output relationship, it is possible to achieve constant and fast output 
generation irrespective of the complexity of the random function operation 

10 itself, by constructing the S-box with a ROM that has the input/output 
relationship as a table. Since the S-box was adopted typically in DES 
(Data Encryption Standard), its security and design strategy have been 
studied. Conventionally, the security criterion assumed in the 
implementation of the S-box is only such that each bit of encrypted data, for 

15 instance, would be a 0 or 1 with a statistical probability of 50 percent — ^this 
is insufficient as the theoretical criterion for the security of block ciphers. 

In actual fact, cryptanalysis methods for block ciphers that meet the 
above-mentioned criterion have been proposed: a differential cryptanalysis 
in literature "E. Biham, A. Shamir, 'Differential Cryptanalysis of DES-like 

20 cryptosy stems,' Journal of Cryptology, Vol. 4, No. 1, pp.3-72" and a linear 
cryptanalysis in literature "M. Matsui, 'Linear Cryptanalysis Method for 
DES Ciphers,' Advances in Cryptology-EUROCRYPT' 93 (Lecture Notes 
in Computer Science 765), pp.386-397, Springer- Verlag, 1994." It has 
been found that many block ciphers can be cryptanalyzed by these methods; 

25 hence, it is now necessary to review the criteria for security. 

After the proposal of the differential and linear cryptanalysis 
methods the block ciphers have been required to be secure against them. 




-3- 



To meet the requirement, there have been proposed, as measures indicating 
the security against the cryptanalysis methods, a maximum average 
differential probability and a maximum average linear probability in 
literature "M. Matsui, *New Structure of Block Ciphers with Provable 
5 Security against Differential and Linear Cryptanalysis,' D. GoUmann, editor. 
Fast Software Encryption, Third International Workshop, Cambridge, UK, 
February 1996, Proceedings, Vol. 1039 of Lecture Notes in Computer 
Science, pp. 205-218, Springer- Verlag, Berlin, Heidelberg, New York, 
1996." It is indicated that the smaller the measures, the higher the security 

10 against the respective cryptanalysis. 

Moreover, it has recently been pointed out that even ciphers secure 
against the differential and the linear cryptanalysis are cryptanalyzed by 
other cryptanalysis methods, and consequently, the criterion for security 
needs a further reappraisal. More specifically, in literature "T, Jackson, L, 

15 R. Knudsen, *The Interpolation Attack on Block Ciphers,' Fast Software 
Encryption Workshop (FSE4) (Lecture Notes in Computer Science 1276), 
pp. 28-40, Springer- Verlag, 1997," it is described that some ciphers, even if 
secure against the differential and the linear cryptanalysis, are cryptanalyzed 
by a higher order differential attack or interpolation attack, 

20 Other than the higher order differential attack and interpolation 

attack, a partitioning cryptanalysis generalized from the linear cryptanalysis 
is introduced in literature "C. Harpes, J. L. Massey, 'Partitioning 
Cryptanalysis, 'Fast Software Encryption Workshop (FSE4) (Lecture Notes 
in Computer Science 1267), pp. 13-27, Springer- Verlag, 1997," and hence it 

25 is necessary to provide ciphers with sufficient security against this 
cryptanalysis. 

The technology to ensure the security against the differential and the 
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linear cryptanalysis has been established for the construction of some block 
ciphers, while as of this point in time no technology has been established yet 
which guarantees perfect security against the higher order differential attack, 
the interpolation attack and the partitioning attack. In other words, there 
5 have not been clarified necessary and sufficient conditions that random 
functions, i.e. the so-called S-boxes, need to satisfy so as to make ciphers 
invulnerable to these attacks. 

In designing the S-boxes it is an important issue to provide sufficient 
security against these attacks. The attacks on the S-boxes utilize any 

10 imbalances in their input/output relationships. Accordingly, to design an S- 
box resistant to an attack is to design an S-box that has little unbalanced, 
that is, random input/output relationship. Hence, to evaluate the resistance 
of the S-box to an attack is equivalent to the evaluation of its randomness. 

It is therefore an object of the present invention to provide a function 

15 randonmess evaluating apparatus and method which find out a criterion 

closely related to the level of security against each of the above-mentioned 
attacks, the criterion representing a necessary condition to be met for 
providing the resistance to the attack (not a necessary and sufficient 
condition for guaranteeing the security against the attack), and evaluate the 

20 randomness of the function concerned according to the criterion, and a 
recording medium having recorded thereon the method as a program. 
Another object of the present invention is to provide an apparatus and 
method for generating a random function that satisfies the security criterion, 
and a recording medium having recorded thereon the method as a program. 

25 



DISCLOSURE OF THE INVENTION 

The function randonmess evaluating apparatus and method 



according to the present invention execute at least one of the processes of: 

calculating the minimum value of the degree of a Boolean 
polynomial regarding the input by which each output bit of the function to 
be evaluated is expressed, and evaluating the resistance of the function to 
5 higher order differential cryptanalysis accordingly; 

when fixing a key y and letting x denote the input, expressing an 
output y by y = fk(x) using a polynomial over the Galois field which is 
composed of elements equal to a prime p or a power of the prime p, then 
_ calculating the number of terms of the polynomial, and evaluating the 

10 resistance of the function to interpolation cryptanalysis accordingly; 
Oi dividing all inputs of the function to be evaluated and the 

corresponding outputs into input subsets and output subsets, then calculating 
an imbalance of the relationship between the subset of an input and the 
subset of the corresponding output with respect to their average 
15 corresponding relationship, and evaluating the resistance of the function to 
partitioning cryptanalysis accordingly; and 

calculating, for every set of input difference Ax and output mask 
value r y of the function S(x) to be evaluated, the number of inputs x for 
which the irmer product of (S(x)+S(x A x)) and the output mask value r y is 
20 1, and evaluating the resistance of the function to differential-linear 
cryptanalysis accordingly . 

The random function generating apparatus and method according to 
the present invention generate candidate functions each formed by a 
plurality of functions of different algebraic stmctures and having a plurality 
25 of parameters, evaluates the resistance of each candidate function to 
cryptanalysis, and select candidate functions of higher resistance to the 
cryptanalysis. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a block diagram illustrating an example of the functional 
configuration of each of the random function generating apparatus and the 
function randonmess evaluating apparatus according to the present 
5 invention. 

Fig. 2 is a block diagram depicting an example of the basic 
configuration of the random function generating apparatus according to the 
present invention. 



10 embodiment of the random function generating apparatus according to the 
present invention. 

BEST MODE FOF CARRYING OUT THE INVENTION 
Embodiment according to a first aspect of the present invention 



embodiment of each of the random function generating apparatus and the 
function randomness evaluating apparatus according to the present invention. 
An input part 11 inputs therethrough data and a parameter that are needed to 
generate a candidate function in a candidate function generating part 12. 

20 The candidate function generating part 2 generates a candidate function 
based on the input provided through the input part 11, and provides its 
parameter value, the input value and the calculation result (an output value) 
to a storage part 13. Various pieces of data thus stored in the storage part 
13 are read out therefrom and fed to a differential-cryptanalysis resistance 

25 evaluating part 14a, a linear-cryptanalysis resistance evaluating part 14b, a 
higher-order-differential-attack resistance evaluating part 14c, an 
interpolation-attack resistance evaluating part 14d, a partitioning-attack 



Fig. 3 is a flowchart showing an example of a procedure of an 



15 



In Fig. 1 there is depicted the functional configuration of an 
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resistance evaluating part 14e, a differential-linear-attack resistance 
evaluating part 14f, and a criteria evaluating part 14g for evaluating other 
criteria. Based on the results of evaluations made in the respective 
evaluating parts, candidate functions of high resistance to the attacks are 
5 selected in a function select part 15 and stored in a storage part 16, from 
which a required one of the candidate functions is read out and provided to 
the outside via an output part 17. 

In the function randomness evaluating apparatus according to the 
present invention, the functions to be evaluated are provided via the input 

10 part 11 to the respective evaluating parts 14a to 14g for the evaluation of 
their randonmess. 

A description will be given below of security criteria for the 
differential cryptanalysis, the linear cryptanalysis, the higher order 
differential attack, the interpolation attack, the partitioning attack and the 

1 5 differential-linear attack and of necessary conditions for the security criteria 
to have resistance to the respective attacks. In the following description, 
let n and m be arbitrary natural numbers and consider, as the S-box (a 
random function), a function S of an n-bit input and an m-bit output: 
GF(2)'^ ^ GF(2)'". GF(2)" represents a set of all n-bit data. 

20 (a) Necessary Condition for Resistance to Differential Cryptanalysis 
A description will be given below of a criterion for differential 
cryptanalysis is defined as a measure of the resistance thereto of the S-box, a 
method for measuring the criterion and a necessary condition for the 
resistance to differential cryptanalysis. In the differential cryptanalysis 

25 method, an observation is made of the difference between outputs (an output 
difference value) of the S-box corresponding to the difference between its 
two inputs (an input difference value), and if a large imbalance is found 
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between them, it can be used to cryptanalyze the whole cipher. 

Letting the input to the S-box be represented by x, the difference 
value between the two inputs by Ax, the difference value of the two outputs 
corresponding to the two inputs by Ay, the function of the S-box by S and 
the output y from the S-box for the input thereto by y=S(x), let 6^(Ax,Ay) be 

the number of those xs of all n-bit inputs x which satisfy the following 
equation (1) for an arbitrary input difference value Ax and an arbitrary 
output difference value A y. 

S(x) + S(x+Ax)= Ay (1) 
where is usually defined by the exclusive OR (XOR) for each bit. As 
described in literature "X. Lai, L M. Massey, and S. Murphy, 'Markov 
Ciphers and Differential Cryptanalysis,' In D. W. Davies, editor. Advances 
in Cryptology-EUROCRYPT '91, Volume 547 of Lecture Notes in 
Computer Science, pp, 17-38, Springer- Verlag, Berlin, Heidelberg, New 
York, 1991," the difference operation can be substituted with an arbitrary 
binary operation that provides a general inverse; the differential 
cryptanalysis method mentioned herein includes them. The differential 
cryptanalysis utilizes an imbalance in the relationship between the operation 
results on two arbitrary inputs and the two outputs corresponding thereto. 

The number ds{/!ix,Ay) of inputs x that satisfy Eq. 81) for a given 

pair of Ax and Ay is expressed by the following equation (2): 

ds (Ajc, Ay) =#{jc e GF(2y \S(x) + 5(jc + Ax) = Ay} (2) 
where #{x | conditional equation} represents the number of inputs x that 
satisfy the conditional equation. The number 3^ (Ax, Ay) of inputs x can be 
calculated from Eq. (2) for all pieces of n-bit data A x as the input difference 
value, except 0, and all pieces of m-bit data Ay as the output difference 
value. A combination of Ax and Ay that maximizes the above-said 
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number constitutes a vulnerability to the differential cryptanalysis— this 
means that the smaller the maximum value of 6^ (Ax, Ay), the higher the 
resistance to differential cryptanalysis. Therefore, it is the necessary 
condition for the resistance to differential cryptanalysis that the criterion for 
differential cryptanalysis, , given by the following equation (3) is small. 

A^ = max (Ax, Ay) (3) 
Eq. (3) indicates selecting that one of all the combinations of Ax 0 and Ay 
which provides the maximum value of and using it as the value of A^ . 
(b) Necessary Condition for Resistance to Linear Cryptanalysis 

A description will be given below of the definition of a criterion for 
linear cryptanalysis as a measure of the resistance thereto of the S-box, a 
method for measuring the criterion and a necessary condition for the 
resistance to linear cryptanalysis. 

In the linear cryptanalysis method, an observation is made of an 
arbitrary exclusive OR between the input and output values of the S-box, 
and if a large imbalance is found between them, it can be used to 
cryptanalyze the whole cipher. 

Letting the input to the S-box be represented by x, an input mask 
value by r X and an output mask value by r y, {Tx, Ty) defined by the 

following equation (4) can be calculated for a certain input mask value Tx 
and a certain output mask value r y. 



where " • " is usually defined by the inner product. x^Tx means sunmiing- 
up of all only those bit values in the input x which correspond to "Is" in 
the mask value r x, ignoring the bit values corresponding to "Os". That is, 
X • Tjc = 2jc, (where 2 is the sum total of i-th bits in Fx which are "Is"), 
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where x=(Xn.i, ... , Xq). The same is true of y • Ty , Accordingly, Eq. (4) 
expresses the absolute value of a value obtained by subtracting from the 
double of the number of those of all (2") n-bit inputs x which satisfy 
X • r x=S(x) • r y for given sets of mask values ( r x, r y). 
5 From Eq. (4) (rjc,ry) can be calculated for all sets of n-bit data 

r X as the input mask value and m-bit data r y as the output mask value, 
except 0. A combination of Fx and Ty that 

maximizes A5 (Fx, ry) constitutes a vulnerability to the linear cryptanalysis— 
this means that the smaller the maximum value of (Fjc,Fy) , the higher the 
10 resistance to linear cryptanalysis. Therefore, it is the necessary condition 
for the resistance to linear cryptanalysis that the criterion for linear 
cryptanalysis, , given by the following equation (5) is small. 

=maxA5(Fx,Fy) (5) 

Eq. (5) indicates selecting that one of all the combinations of Fx 
1 5 and F y 0 which provides the maximum value of A^ (Fjc, Ty) and setting as 
the value of A^ . 

(c) Necessary Condition for Resistance to Higher Order Differential Attack 
A description will be given below of the definition of a criterion for 

higher order differential attack as a measure of the resistance thereto of the 
20 S-box, a method for measuring the criterion and a necessary condition for 

the resistance to higher order differential attack. 

The higher order differential attack utilizes the fact that the 

computation of a higher order differential the intermediate output in the 

course of encryption with respect to the input provides a key-independent 
25 constant. An arbitrary bit of arbitrary intermediate data during encryption 

can be expressed by a Boolean polynomial regarding the input. For 

instance, a bit y: of certain intermediate data can be expressed by a Boolean 
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polynomial regarding an N-bit input x as follows: 

Yj = X0+X1X3+X0X2X3+ ... +X1X4X5X6 ... Xn (6) 
When the degree of the Boolean polynomial is d, the calculation of the 
(d+l)-th order differential (for instance, XOR of 2^'^^ outputs) results in 
5 providing a key-independent constant; attacks on ciphers of low-degree 
Boolean polynomials are reported in the afore-mentioned literature A. 

With a low-degree Boolean polynomial representation of an F- 
function, an insufficient number of iterations of the F-function will not raise 
the degree of the Boolean representation of the whole cipher, increasing the 
10 risk of the cipher being cryptanalyzed. Hence, a necessary condition for 
making the cipher secure against higher order differential attack without 
increasing the number of iterations of the F-function is that the degree of the 
Boolean polynomial representation of the S-box as a component of the F- 
function is also high. 
15 For 

S-box S: GF(2)'^^GF(2)'" ; xi^S(x), 

set 

y = S(x), (7a) 
X = (x„.i x„.2, ... , xo) e GF(2)^ (7b) 
20 y = (y,.i, y^.2. . yo) ^ GF(2)- (7c) 

And a set of variables X = {x^.j, x„.2' Xq} is defined. At this time, a 
Boolean function y-^ = Si(x) is defined as follows: 

Si : GF(2)'^ ^ GF(2); x h> Si(x) (8) 
Let deg^Sj denote the degree of the Boolean function Sj (0<:i^m-l) 
25 regarding the variable set X. Let the minimum value of deg^S^ (0 ^ i ^ m-1) 
be represented by deg^S, which is the criterion for higher order differential 
attack. 
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deg,S - min(deg,SO (9) 
where min is conditioned by Osi:sm-l. 
A necessary condition that the S-box needs to satisfy to provide security 
against higher order differential attack is that deg^^S has a large value. It is 
5 known that when S is bijective (i.e. the input/output relationship can be 

determined uniquely in both directions), the maximum value of deg^S is n-1. 
(d) Necessary Condition for Resistance to Interpolation Attack 

A description will be given below of the definition of a criterion for 
interpolation attack as a measure of the resistance thereto of the S-box, a 
5 10 method for measuring the criterion and a necessary condition for the 
S resistance to interpolation attack. 

s _ s 

The principle of interpolation attack is as follows: With a key k 
r{ fixed, a ciphertext y can be expressed, for example, by the following 

L, equation using a polynomial f^(x) over GF(q) regarding a plaintext x, 

W 15 y = fk(x) = Cq_ix'^'^ + Cq.jx'''^ + ... + CjX^ + ... H-c^x^ + CqX^ (10) 

W where q is a prime or its power. When the number of terms of non-zero 

O coefficients contained in the polynomial fk(x) with respect to x is c, the 

polynomial f^(x) can be constructed as by the Lagrange interpolation 
theorem if c different sets of plaintexts and the corresponding sets of 
20 ciphertexts (xj, y^) (where i = 1, ... , c) are given. By this, a ciphertext 
corresponding a desired plaintext x can be obtained. 

The larger the number of terms contained in the polynomial fk(x), the 
larger the number of sets of plaintexts and ciphertexts necessary for 
interpolation attack using the polynomial representation fk(x) over GF(q), 
25 and the attack becomes difficult accordingly or becomes impossible. 
When the number of terms contained in the polynomial 
representation over GF(q) of the S-box is small, there is a possibility that the 
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number of terms contained in the polynomial of the whole cipher over GF(q) 
decreases. Of course, even if the number of terms contained in the 
polynomial over GF(q) of the S-box is large, care should be taken in the 
construction of the whole cipher to avoid that the terms cancel out each 
5 other, resulting in a decrease in the number of terms contained in the 
polynomial over GF(q) of the whole cipher; however, this concerns 
encryption technology, and as the criterion of the S-box for interpolation 
attack, it is a necessary condition for the resistance to interpolation attack 
^ that the number of terms contained in the polynomial representation over 

m 10 GF(q) is large. Let the number of terms contained in the polynomial 
gi representation over GF(q) of the function S of the S-box be represented by 

3 coeffqS, which is used as the criterion for interpolation attack using the 

polynomial representation over GF(q). 
™ Since the interpolation attack exists by the number of possible qs, it 

1^ 15 is desirable to calculate the number of terms coeff^S in as many polynomials 
jy over GF(q) as possible and make sure that they do not take small values. 

Q (e) Necessary Condition for Resistance to Partitioning Cryptanalysis 

A description will be given below of the definition of a criterion for 
partitioning cryptanalysis as a measure of the resistance thereto of the S-box, 
20 a method for measuring the criterion and a necessary condition for providing 
the resistance to partitioning cryptanalysis. In partitioning cryptanalysis, 
an observation is made of some measure which holds for a certain subset of 
the whole plaintext set and a certain subset of the whole ciphertext set, and 
if a large imbalance is found in the measure, then it can be used to 
25 cryptanalyze the whole cipher. As "some measure I" there are mentioned a 
peak imbalance and a squared Euclidean imbalance in literature "C. Harpes, 
J. L. Massey, 'Partitioning Cryptanalysis,' Fast Software Encryption 
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Workshop (FSE4) (Lecture Notes in Computer Science 1267), pp. 13-27, 
Springer- Verlag, 1997/' 

In literature "Takeshi Hamada, Takafumi Yokoyama, Tohru Shimada, 
Toshinobu Kaneko, 'On partitioning cryptanalysis of DES,' Proc. in 1998 
5 Symposium on Cryptography and Information Security (SCIS'98-2.2.A)," it 
is reported that an attack on the whole cipher succeeded through utilization 
of imbalance observed in input and output sets of the S-box of the DES 
cipher—this indicates that the criterion for partitioning cryptanalysis 
similarly defined for the input and output sets of the S-box is a necessary 
10 condition for the whole cipher to be secure against partitioning 
cryptanalysis. 

Let u divided subsets of the whole set of S-box inputs be represented 
by Fq, Fi, „. , F^.i and v divided subsets of the whole set of S-box outputs by 
Gq, Gi, ... , G^.j. Suppose that all the subsets contain an equal number of 

15 elements, A function f for mapping the input x on the subscript {0, 1, ... , 
u-1} of each subset will hereinafter be referred to as an input partitioning 
function and a function g for mapping the output y on the subscript {0, 1, ... , 
v-1} of each subset as an output partitioning function. That is, the function 
f indicates the input subset to which the input x belongs, and the function g 

20 indicates the output subset to which the output y belongs. Let partitions F 
and G be defined by 



Then, an imbalance Is(F, G) of an S-box partition pair (F, G) is given by the 
25 following equation (11). 



G = {Go, Gi, G^ i}. 




(11) 
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Expressing I(g(S(x))|F(x)=i on the right-hand side of Eq. (11) by I(V), this is 
the afore-mentioned "Measure 1." According to the afore-mentioned 
literature by C. Harpes et al., in the case of using the peak imbalance as this 
measure, it is expressed as follows: 

5 ip(V)= ^[inax^[v^ = 7]-^] (12) 

In the case of using the squared Euclidean imbalance as this measure, it is 
expressed as follows: 

'b(V)= = (13) 

P[V=j] represents the probability that the whole output y corresponding to 
10 the whole input x of an i-th (i=0, ... , u-1) input group assigned to an 
output group Gj (j=0, ... , v-1), and the sum total of probabilities of the 
assignment to respective output groups is 1. For example, if kj outputs of 
the whole output y (k; outputs) corresponding to the whole input x (assumed 
to consist of ki inputs) are assigned to the group Gj, then the probability of 
15 assignment to the group Gj is kj/kj. The peak imbalance Ip(y) of Eq. (12) 
represents a value obtained by normalizing imbalance of the maximum 
assignment probability relative to an average probability, and the Euclidean 
imbalance Ie(V) of Eq. (13) represents a value obtained by normalizing a 
square-sum of imbalance of the assignment probability from the average one. 
20 This measure Ip or is applied to Eq, (11) to calculate the imbalance Is(F, 
G) for each partition-pair (F, G). The partition-pair varies, for instance, 
with the way of selecting the partitioning functions f and g. For example, 
the division numbers u and v are also parameters that are specified by the 
functions f and g. 

25 The measure given by Eq. (11) is the criterion for the partitioning 
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attack on the S-box and takes a value greater than 0 and smaller than 1; it is 
a necessary condition for the resistance to the partitioning attack that the 
difference between the above value and its one-half is small. Accordingly, 
the S-box function is chosen which minimizes the value |Is(F> G)-l/2|. 
5 (f) Necessary Condition for Resistance to Differential-Linear Cryptanalysis 
A description will be given below of the definition of a criterion for 
differential-linear cryptanalysis as a measure of the resistance thereto of the 
S-box, a method for measuring the criterion and a necessary condition for 
providing the resistance to differential-linear cryptanalysis, 
10 In differential-linear cryptanalysis, an observation is made of, for 

example, the exclusive OR of S-box input and output difference values, and 
if a large imbalance is found, then it can be used to cryptanalyze the whole 
cipher. 

Letting the S-box input, input difference value and output mask 
1 5 value be represented by x, Ax and r y, respectively, §^(Ax, Ty) defined 
by the following equation can be calculated. 

(Ax, ry) = |2#{x e GF(2y \[S(x) + + Ax)] • = 1} - 2" | (14) 

where the operations and " • " are the same as those used in the criterion 
for differential cryptanalysis and the criterion for linear cryptanalysis, 
20 respectively. The maximum value S § given by the following equation for 
any one of all combinations of Ax and Ty in the measure ^s(Ax, Ty) 
thus calculated is used as the criterion for differential-linear cryptanalysis. 

S5-max§5(Ax,r3.) (15) 

Ax-0,rypiO 

Since a large value of the criterion H § may be a weakness in differential- 
25 linear cryptanalysis, it is a necessary condition for the resistance thereto that 
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this value is small (no marked imbalance). 

Incidentally, such functions S as expressed by the following 



5 



equations are used in some ciphers. 

S: GF(2)"^GF(2)": x-^x^'' in GF(2°) 
S: GF(2)" — GF(2)": x^x^"*^ in GF(2°) 



(16a) 
(16a) 



Letting k denote a natural number equal to or greater than n, the differential- 
linear attack criteria of these functions S take 2n (the maximum theoretical 
value). No report has been made of an example in which this property 
leads to a concrete cipher attack, but it is desirable that the criteria take as 

10 small a value as possible. 

Next, a description will be given of an embodiment according to a 
second aspect of the present invention. 

The resistance of the S-box to various attacks is evaluated as 
described above, but the generation of a highly resistant random function 

15 gives rise to an issue of how to select a group of candidate functions. The 
reason for this is that much complexity is needed to select functions 
satisfying the above-mentioned condition from an enormous number of 
functions. 



20 Knudsen, *The Interpolation Attack on Block Cipher,' Fast Software 

Encryption Workshop (FSE4) (Lecture Notes in Computer Science 1267), 
pp. 28-40, Springer- Verlag, 1997," it is known that the block cipher is 
readily cryptanalyzed by the higher order and the interpolation cryptanalysis 
in the case where the S-box is formed by a function of a certain algebraic 

25 structure selected as a function resistant to the differential and the linear 

cryptanalysis and the whole cipher is constructed in combination with only 
by an operation which does not destroy the algebraic stmcture. On the 



By the way, from an example cited in literature "T. Jakobsen, L. R. 
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other hand, the inventors of this application have found that a composite 
function, which is a combination of a function resistant to the differential 
and the linear cryptanalysis with a function of a different algebraic structure 
(basic operation structure), is also resistant to other attacks in many cases, 
5 According to the second aspect of the present invention, functions 

resistant to the differential and the linear cryptanalysis and functions which 
have algebraic structures different from those of the first-mentioned 
functions are combined (composition of functions, for instance) and such 
composite functions are selected as groups of candidate functions; the 

10 resistance to each cryptanalysis is evaluated for each function group and 
functions of high resistance are chosen. 

Incidentally, the way of selecting the candidate function groups in 
the present invention is not limited specifically to the above. 

According to the second aspect of the present invention, a function 

15 (for example, a composite function), which is a combination of at least one 
function resistant to the differential and the linear cryptanalysis with at least 
one function of a different algebraic stmcture is selected as a candidate 
function group. With this scheme, it is possible to efficiently narrow down 
from a small number of candidates those functions which are resistant not 

20 only to the differential and the linear cryptanalysis but also to attacks which 
utilize the algebraic structures of the functions used, such as the higher order 
differential and the interpolation attack. 

In the following embodiment according to the second aspect of the 
present invention, a description will be given of how to design an 8-bit I/O 

25 S-box. 

Now, consider that a P-function part 21for generating a function P(x, 
e) and an A-function part 22 for generating a function A(y, a, b) of an 
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the order of narrowing down the candidates are also highly flexible. 

Step SI: In the input part 11, predetermine the range of each of the 
parameters a, b and e in Eqs. (17) and (18) to be greater than 0 but smaller 
than 2^-1, and limit the Hamming weights Wh(a) and Wh(b) of the 
5 parameters a and b to the range of from 3 to 5. 

Step S2: Evaluate whether candidate functions S are bijective or not. 
When the parameter a is an odd number and the parameter e is prime 
relative to 2^-1 (which parameter is expressed by (e,255)=l), the functions S 
are bijective; select those of the parameters which satisfy these conditions, 
10 and discard candidates which do not satisfy them. This processing is 

performed in the criteria evaluating part 14g in Fig. 1. Alternatively, the 
parameter a is obtained by inputting only an odd number in the input part 11. 

Step S3: It is known that the Hamming weight Wh(e) of the 
parameter e (which weight indicates the number of "Is" in e in the binary 
15 representation; for example, if e = 11101011, Wh(e) = 6) and the degree 
deg^P of the function P in the Boolean function representation are equal to 
each other. The, in order to satisfy the condition for a criterion deg^S of the 
remaining candidate functions S for higher order differential attack, select 
those of the remaining candidate functions S whose parameters e having a 
20 Hamming weights Wh(e) of 7 that is the theoretically maximum value of e, 
that is, select e = 127, 191, 223, 239, 251, 253 and 254. Discard the 
candidates that do not meet the condition. 

Step S4: Determine if any candidates still remain undiscarded. 
Step S5: When it is determined in the preceding step that no 
25 candidate has survived, ease the condition Wh(e) Wh(e)-1 and then go back 
to step S3. 

Step S6: From the candidate functions remaining after the process of 
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Step S3, select those candidates for which the criterion Ag for differential 
attack defined by Eq. (3) is smaller than a predetermined reference value 
A R. Discard the candidates that do not meet this condition. 

Step S7: Determine if any candidates still remain undiscarded after 
5 Step S6. 

Step S8: If no candidate remains, add a predetermined step width A^ 
to the reference value A r (ease the condition) to update it, and return to step 
S6 to repeat the processing. 

Step S9: From the candidate functions S remaining after Step S6, 
10 select those candidates for which the criterion Ag for linear attack defined 
by Eq. (5) is smaller than a predetermined reference value Ar. Discard 
the candidates that do not meet this condition. 

Step SIO: Determine if any candidates still remain undiscarded after 
Step S9. 

15 Step 11: If no candidate remains, add a predetermined step width A^ 

to the reference value A r (ease the condition) to update it, and return to step 
S9 to repeat the processing. 

Step S12: From the candidate functions S remaining after step S9, 
select those candidates for which the criterion S § for differential-linear 
20 attack defined by Eq. (15) is smaller than a predetermined reference value 
S R. Discard the candidates that do not meet this condition. 

Step S13: Determine if any candidates still remain undiscarded after 
Step S12. 

Step S14: If no candidate remains, add a predetermined step width 
25 S d to the reference value S r (ease the condition) to update it, and return to 
step S12 to repeat the processing. 

As a result, the parameters are narrowed down to those given below. 
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(a, b) = (97, 97), (97, 225), (225, 97), (225, 225) 

e = 127, 191, 23, 239, 247, 251, 253, 254 
Step S15: For the candidate functions S by all combinations of the 
parameters remaining after Step S12, calculate the criterion Is(F, G) for 
5 partitioning attack and select those candidates for which |IS(F, G)-l/2| is 
smaller than a reference value Ir. Discard the candidates that do not meet 
this condition. 

Step S16: Determine if any candidates still remain undiscarded after 
Step S15. 

y 10 Step S17: If no candidate remains, add a predetermined step width 1^ 

£ to the reference value Ir (ease the condition) to update it, and retum to step 

^ S15 to repeat the processing. 

Q Step S18: For the candidate functions S by all combinations of the 

parameters remaining after Step S15, select those candidates for which the 
15 criterion coeff^S (where q = 28) for interpolation attack, which utilizes the 
polynomial over GF(2^), is larger than a reference value c^r, and discard the 
other candidates. 

Step S19: Determine if any candidates still remain undiscarded after 
Step SIS. 

20 Step S20: If no candidate remains, subtract a predetermined step 

width Cqd from the reference value CqR (ease the condition) to update it, and 
retum to step S19 to repeat the processing. 

Step S21: From all primes p in the range of from 2^+1 to 2^, select 
those of the candidate functions S for which the criterion coeffpS for 
25 interpolation attack is larger than the reference value CpR, and discard the 
other candidates. 

Step S22: Determine if any candidates still remain undiscarded after 
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Step S21, 

Step S23: If no candidate remains, subtract a predetermined step 
width Cpd from the reference value Cp^ (ease the condition) to update it, and 
return to step S21 to repeat the processing, 
5 As the resuh of the evaluation described above, the following 

combinations (a total of 32 combinations) of parameters are left 
undiscarded. 

(a, b) = (97, 97), (97, 225), (225, 97), (225, 225) 
(e) = 127, 191, 223, 239, 247, 251, 253, 254 
10 This is identical with the results obtained in step S12. This means 

that functions secure against every attack taken into account in this 
embodiment are already obtained in step SI 2. 

Since the 32 functions thus selected are equally strong on the above- 
mentioned criteria, any of the functions can be used as the S-box. 
15 In the evaluation of the S-box or in the function generation, the 

reference values A r, A S r, c^r and CpR of the criteria for evaluation are 
each determined according to the required degree of randomness, that is, the 
required security against the respective cryptanalysis. 

In the flowchart o Fig. 3, the order of selection of function 
20 candidates having the required resistance to the respective attacks 

(cryptanalyses) is not limited specifically to the order depicted in Fig. 3 but 
may also be changed. 

With the random function generating method according to the 
present invention, it is unnecessary to select function candidates that have 
25 the required resistance to every attack shown in Fig. 3; and it also falls 

inside the scope of the present invention to select function candidates for at 
least one of higher order differential, differential-linear, partitioning and 
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interpolation attacks. Instead of narrowing down the function candidates 
one after another for a plurality of cryptanalysis methods, it is also possible 
to evaluate the resistance of every function candidates to the respective 
cryptanalyses and select functions that have the reference resistance to them. 
5 While in the above the random function generating method has been 

described to determine parameters of composite functions each composed of 
two functions, it need scarcely be said that the method is similarly 
applicable to parameters of functions each composed of three or more 
functions and to the determination of parameters of one function, 
g 10 The function randomness evaluating method and the random 

5 function generating method of the present invention, described above in the 

^ first and second embodiments, may also be prerecorded on a recording 

^ medium as programs for execution by a computer so that the programs are 

read out and executed by the computer to evaluate the randomness of 
V 15 functions and generate random functions. 

3 EFFECT OF THE INVENTION 

As described above, according to the present invention, in the 
method and apparatus for evaluating the randonmess of S-box functions that 

20 serve as components of an cryptographic device or the like, there is provided, 
in addition to the conventional evaluating method, means for evaluating 
whether the functions is resistant to differential, linear, higher order 
differential, interpolation, partitioning and differential-linear attacks and 
other possible attacks, whereby it is possible to evaluate the randomness of 

25 the functions and design ciphers highly secure against the above 
cryptanalyses. 

Furthermore, since functions each formed by a combination of a 
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function resistant to differential cryptanalysis and linear cryptanalysis and a 
function of an algebraic structure different from that of the first-mentioned 
function are selected as candidate functions, functions resistant not only to 
the differential and linear cryptanalyses but also to attacks utilizing the 
algebraic structure, such as high order differential and interpolation attacks 
can be narrowed down from a small number of candidates. 

Moreover, such a procedure as depicted in Fig. 3 allows efficient 
narrowing down of functions with a small amount of computational 
complexity. 

Besides, by selecting candidate functions from combinations of 
functions of well-known different algebraic structures instead of selecting 
the candidates at random, it is also easy to show that the S-box has no trap- 
door (a secret trick that enables only a designer to cryptanalyze the cipher 
concemed). 

The random function thus evaluated and generated by the present 
invention is used as the S-box formed as by a ROM to generate an irregular 
outputs from the input to a cryptographic device which conceals data fast 
and securely. 



